{"uuid": "2574b23e-d89e-4381-995b-d31223cc6174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30066", "type": "seen", "source": "https://t.me/pphm_HackerNews/191", "content": "Invisible Threat: Undetected Flaw in Common DevOps Tool Opens Door to Silent Code Hijacking\n\nThe widely used GitHub Action tj-actions/changed-files, which helps developers identify altered files in pull requests, was found to contain a critical remote code execution (RCE) vulnerability (CVE-2025-30066). Attackers could exploit the flaw to inject malicious code into CI/CD pipelines, compromising repositories and stealing sensitive data.\n\n\ud83d\udd17 Read More", "creation_timestamp": "2026-07-20T22:00:04.657496Z"}